CVE-2026-87029

A flaw was found in undici. A remote malicious or compromised HTTP server can cause a Denial of Service (DoS) by sending a small compressed response that decompresses beyond configured size limits. Because undici fails to catch errors triggered by response handlers during decompression, an unhandled exception is produced that crashes the client application.

This vulnerability is rated as Moderate impact because successful exploitation requires an application to connect to an untrusted or compromised HTTP server and utilize a specific client interceptor configuration. A denial of service condition only occurs when the decompression interceptor is composed with a downstream handler that throws errors upon receiving oversized responses. Standard Red Hat environments that connect exclusively to trusted endpoints or run default HTTP pipelines without this specific combination of interceptors are not susceptible to this failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.